A WordPress vulnerability present across millions of sites is being targeted by threat actors, according to security researchers. A number of the security bugs have only recently been patched, leaving a huge number of sites at risk.
The security flaw in question affects WordPress sites with Epsilon Framework themes installed.
Wordfence, the WordPress security plugin provider that discovered the recent attacks, has not revealed much information about the exploit as it does not seem to have reached a mature stage of development.
“On November 17, 2020, our Threat Intelligence team noticed a large-scale wave of attacks against recently reported Function Injection vulnerabilities in themes using the Epsilon Framework, which we estimate are installed on over 150,000 sites,” Ram Gall, a Wordfence QA engineer and threat analyst, explained. “So far today, we have seen a surge of more than 7.5 million attacks against more than 1.5 million sites targeting these vulnerabilities, coming from over 18,000 IP addresses.”
Vulnerable themes
According to Wordfence, the following versions of the Epsilon Framework themes continue to be at risk:
- Shapely <=1.2.7
- NewsMag <=2.4.1
- Activello <=1.4.0
- Illdy <=2.1.4
- Allegiant <=1.2.2
- Newspaper X <=1.3.1
- Pixova Lite <=2.0.5
- Brilliance <=1.2.7
- MedZone Lite <=1.2.4
- Regina Lite <=2.0.4
- Transcend <=1.1.8
- Affluent <1.1.0
- Bonkers <=1.0.4
- Antreas <=1.0.2
- NatureMag Lite <=1.0.5
It appears that the majority of attacks are simply probing for further vulnerabilities, although a remote code execution exploit is possible that would allow an attacker to take over a compromised site.
If an individual’s website is running one of the vulnerable themes, it is essential that they update to a patched version if available. If not, it is probably best to temporarily switch to another theme. Alternatively, adopting a WordPress firewall plugin should offer protection.
Via BleepingComputer
